CVE-2016-4972

@@ -43,15 +43,15 @@ def build_position(node):
                 node.end_mark.line + 1,
                 node.end_mark.column + 1)
 
-        class MuranoPlYamlConstructor(yaml.constructor.Constructor):
+        class MuranoPlYamlConstructor(yaml.constructor.SafeConstructor):
             def construct_yaml_map(self, node):
                 data = MuranoPlDict()
                 data.source_file_position = build_position(node)
                 yield data
                 value = self.construct_mapping(node)
                 data.update(value)
 
-        class YaqlYamlLoader(yaml.Loader, MuranoPlYamlConstructor):
+        class YaqlYamlLoader(yaml.SafeLoader, MuranoPlYamlConstructor):
             pass
 
         YaqlYamlLoader.add_constructor(
@@ -60,7 +60,7 @@ class YaqlYamlLoader(yaml.Loader, MuranoPlYamlConstructor):
 
         # workaround for PyYAML bug: http://pyyaml.org/ticket/221
         resolvers = {}
-        for k, v in yaml.Loader.yaml_implicit_resolvers.items():
+        for k, v in yaml.SafeLoader.yaml_implicit_resolvers.items():
             resolvers[k] = v[:]
         YaqlYamlLoader.yaml_implicit_resolvers = resolvers
 

@@ -249,7 +249,7 @@ def _convert_service(cls, service):
         """
         component = service.to_dict()
         component = json.dumps(component)
-        return yaml.load(component)
+        return yaml.safe_load(component)
 
     @classmethod
     def get_service_id(cls, service):

@@ -87,7 +87,7 @@ def _load_file(self, file_name):
             os.path.dirname(inspect.getfile(self.__class__)), file_name)
 
         with open(model_file) as stream:
-            return yaml.load(stream)
+            return yaml.safe_load(stream)
 
     def _create_rules_str(self, model_file, package_loader=None):
         model = self._load_file(model_file)

@@ -0,0 +1,9 @@
+---
+security:
+  - cve-2016-4972 has been addressed. In ceveral places
+    Murano used loaders inherited directly from yaml.Loader
+    when parsing MuranoPL and UI files from packages.
+    This is unsafe, because this loader is capable of creating
+    custom python objects from specifically constructed
+    yaml files. With this change all yaml loading operations are done
+    using safe loaders instead.